SPF vs DKIM vs DMARC: Email Authentication Complete Guide

The Email Authentication Trinity

SPF (Sender Policy Framework)

SPF allows domain owners to specify which mail servers are authorized to send email on behalf of their domain. The receiving mail server checks whether the sending server's IP address matches the authorized IPs listed in the domain's SPF TXT record.

An SPF record looks like: v=spf1 include:_spf.google.com include:mailgun.org ip4:203.0.113.5 ~all

The mechanisms: include: delegates to another domain's SPF; ip4:/ip6: specifies explicit IPs; a: includes the domain's A record IP; mx: includes MX server IPs. The qualifier at the end (-all = hard fail, ~all = soft fail, ?all = neutral) determines what happens to mail from unlisted sources.

SPF limitation: SPF only checks the envelope "From" (MAIL FROM / Return-Path), not the visible "From" header that users see. Email forwarders break SPF because the forwarding server's IP wasn't in the original sender's SPF record.

DKIM (DomainKeys Identified Mail)

DKIM adds a cryptographic signature to outgoing email headers. The sending mail server signs the message with a private key; the receiving server retrieves the corresponding public key from DNS and verifies the signature. This proves the message came from an authorized sender and wasn't altered in transit.

A DKIM signature in email headers: DKIM-Signature: v=1; a=rsa-sha256; d=example.com; s=mail; ...

The DNS record for DKIM: mail._domainkey.example.com TXT "v=DKIM1; k=rsa; p=MIIBIjANBg..."

DKIM advantages over SPF: DKIM survives email forwarding (the signature travels with the message); it authenticates message content integrity not just server IP; it works with the header "From" domain. DKIM limitation: DKIM alone doesn't prevent display name spoofing or domain impersonation visible to users without DMARC enforcement.

DMARC (Domain-based Message Authentication, Reporting & Conformance)

DMARC builds on SPF and DKIM by adding policy enforcement and reporting. It requires that at least one of SPF or DKIM not only passes but also "aligns" — meaning the authenticated domain matches the visible "From" header domain that recipients see.

A DMARC record: _dmarc.example.com TXT "v=DMARC1; p=reject; rua=mailto:dmarc@example.com; ruf=mailto:forensic@example.com; pct=100"

DMARC policies: p=none (monitor only, no action); p=quarantine (send to spam if fails); p=reject (reject emails that fail). The rua tag specifies where aggregate reports are sent; ruf for forensic reports of individual failures.

Reporting: DMARC's reporting mechanism is unique — receiving mail servers send XML aggregate reports back to the sender, listing all mail they processed claiming to be from your domain, with pass/fail results for SPF and DKIM. This gives domain owners visibility into who is sending email on their behalf — essential for detecting spoofing and identifying unauthorized senders.

How SPF, DKIM, and DMARC Work Together

Checking SPF, DKIM, and DMARC Records

Use our DNS Lookup tool to inspect all three records for any domain:

• SPF: Query TXT records for the domain root (e.g., example.com). Look for a record starting with v=spf1.
• DKIM: Query TXT records for selector._domainkey.example.com — you need to know the selector name (often "mail", "google", "smtp", or found in email headers).
• DMARC: Query TXT records for _dmarc.example.com. The full record shows policy, reporting addresses, and alignment mode.

Our Email Checker tool also validates SPF and DMARC status for any domain automatically.

FAQs: SPF vs DKIM vs DMARC